NEAR Intents has announced that it identified the individual it believes was responsible for a security breach that took $3.8 million in user funds, and has issued a 48-hour deadline for the money to be returned.
The protocol’s general manager, Alex Shevchenko, said on Friday that the suspected attacker could still return the assets under a “responsible disclosure” arrangement. He published three wallet addresses for Bitcoin, BNB and Solana transfers and warned that the opportunity would end after 48 hours.
The incident places the focus on both recovering the stolen assets and determining how the breach occurred. NEAR Intents said it had paused its services on Thursday after detecting a problem involving the interaction between its smart contract and the Omni deposit and withdrawal infrastructure.
What happened to the funds
NEAR Intents’ preliminary investigation concluded that approximately $3.8 million in user funds had been stolen. The protocol said it would fully compensate users affected by the incident, although the source material does not provide details on the timing or mechanism of those payments.
Blockchain investigator ZachXBT said the stolen funds were moved to the KuCoin exchange and then bridged to the Bitcoin network. Bridging generally refers to transferring assets or their representation between blockchain networks, allowing funds to move beyond the chain on which they were initially held.
According to Cointelegraph, Shevchenko’s message framed the 48-hour period as the final chance for the suspected attacker to use responsible disclosure. In cybersecurity, responsible disclosure typically involves reporting or resolving a vulnerability in a way intended to limit further harm. NEAR Intents did not disclose the identity of the person it says it identified.
The technical issue under investigation
NEAR Intents attributed the service suspension to a bug in the interaction between its Omni deposit and withdrawal infrastructure and the NEAR Intents smart contract. A smart contract is software deployed on a blockchain that can automatically execute predefined instructions.
The available information does not establish whether the bug itself, an interaction with another system, or another factor enabled the theft. The protocol has described its investigation as preliminary, so further details about the vulnerability and the movement of the funds were not provided.
Current market picture
Moneyiar market data recorded at 09:19 on October 3, 2026, shows NEAR Protocol trading at $4.6617819374. The token was down 5.23% over 24 hours and 4.34% over seven days.
Other assets in the supplied Moneyiar data showed mixed performance. Decentraland was priced at $0.1017023206, down 1.27% in 24 hours but up 11.37% over seven days. Ailey stood at $0.2694333637, falling 0.18% over 24 hours and rising 0.05% over seven days. Loaded Lions traded at $0.0015142325, down 2.74% over 24 hours and 0.12% over seven days.
These figures describe market prices and percentage changes at the stated time; they do not establish a direct connection between the breach and NEAR’s token performance.
